Exchange must use encryption for Outlook Web App (OWA) access.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-228416 | EX16-MB-002910 | SV-228416r879519_rule | CCI-000068 | medium |
| Description | ||||
| This setting controls whether client machines should be forced to use secure channels to communicate with this virtual directory. If this feature is enabled, clients will only be able to communicate with the directory if they are capable of supporting secure communication with the server. The use of secure communication prevents eavesdroppers from reading or modifying communications between servers and clients. The network and DMZ STIG identify criteria for OWA and Public Folder configuration in the network, including Common Access Card (CAC)-enabled pre-authentication through an application firewall proxy. Failure to require secure connections on a website increases the potential for unintended eavesdropping or data loss. | ||||
| STIG | Date | |||
| Microsoft Exchange 2016 Mailbox Server Security Technical Implementation Guide | 2023-12-18 | |||
Related Frameworks
3 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
AC-17(2)
1.00
- DISA · V2R6 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1711 mapping
3.1.13
1.00
- DISA · V2R6 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000068
1.00
- DISA · V2R6 · disa_xccdf · related
Details
Check Text (C-228416r879519_chk)
Open a Exchange Management Shell and enter the following command:
Get-OwaVirtualDirectory | select internalurl, externalurl
If the value returned is not https://, this is a finding.
Fix Text (F-30634r497045_fix)
Configure the OWA site to require SSL port 443.